Backup for M365 configuration and Entra ID with EtherInsights Tenant Backup
This is the page about EtherInsights Tenant Backup — EfficientEther's product for backing up the Microsoft 365 configuration. Entra ID policies, app consent, Exchange mail-flow rules, Intune assignments, Teams policies. Everything that governs how your tenant behaves, but is not the content inside it.
This is not a content backup. Files, email, documents, Teams chats — that lives in Hornetsecurity 365 Total Backup, Xopero ONE or GitProtect. EtherInsights fills the gap next to them: when a Conditional Access policy has to be rolled back, when you need to see which apps actually got admin consent last quarter, when an Exchange rule was changed by the wrong person and no one remembers what it looked like before — that is what this backup answers.
A customer who wants full protection of their Microsoft 365 tenant needs both — a content backup and a configuration backup. They are not competitors.
ARJ Distribution sells only through resellers and MSPs in the Nordics — Sweden, Norway, Denmark, Finland and Iceland — never direct to the end customer.
The content itself — files, email, Teams chats, Entra ID objects — sits outside. This is the backup of the configuration: policies and rules, not deleted files. To restore a user or a folder you need Hornet 365 Total Backup or Xopero. To roll back a Conditional Access policy, you need this.
Why configuration backup
Microsoft has several ways to protect the content in a tenant. Recycle bins, retention policies, a Hornet 365 Total Backup sitting next to it. A deleted file or a closed user account can be brought back.
But the configuration? When someone changes a Conditional Access policy, adds a named location, activates an Intune assignment, approves an app with broad API permissions, rewrites an Exchange mail-flow rule — the old settings are overwritten. Microsoft does not keep them anywhere. The audit log exists, but it tells you who did what, not what the value was before. It restores nothing.
EtherInsights Tenant Backup takes scheduled snapshots of the tenant configuration and stores them in the customer's own Azure Blob Storage or Impossible Cloud. When a setting has moved in the wrong direction, you can compare it against a pinned reference, see exactly what differs, and restore the setting on the existing Microsoft object.
Why EtherInsights? Because configuration backup at this breadth does not exist in Hornetsecurity, Xopero or GitProtect — and Microsoft's own tools do not answer "what did this policy look like in August". EtherInsights is at heart a governance platform for Microsoft 365; Tenant Backup is the module that fills that gap.
What is protected
Five workloads, with different depths of what can actually be restored and what can only be reviewed:
| Workload | What is protected |
|---|---|
| Identity (Entra ID) | Authentication Methods Policy, Cross-tenant Access Settings, Entra Role Assignments, Groups and group membership, Administrative Units, User Details (name, organisation, address, contact, employment, manager). Sign-in ability is handled separately. |
| Applications and consent | App registrations — redirect URLs, API permissions, app roles, exposed scopes, token and claim settings. Enterprise app consent — which apps have been granted what access. Comparison shows both access removed and access added since the backup. |
| Exchange Online | Anti-spam, anti-phishing, anti-malware and mail-flow configuration. Policies and rules that control what arrives, what is removed and what is flagged. |
| Purview | Governance configuration (collections, resource-set rules, scan-rule sets). Compliance (sensitivity labels, auto-labelling, retention, DLP) — backup-only, not restorable. |
| Intune and Teams | Intune Assignment Filters and Scope Tags — who can see and change which policies. Teams meeting policies plus Messaging, App, External Access, Guests, Calling and Events policies — mostly backup-only. |
Backup-only means the configuration is captured and can be reviewed, compared and produced as evidence for an auditor — but the restore has to be done by hand in Microsoft's own UI. It is Microsoft's own configuration services that do not offer the write paths needed; EtherInsights cannot write where Microsoft does not let it write.
What this is not
Two boundaries that decide whether the customer gets the right product for the right problem:
- Not a content backup. Files, email, documents, Teams chats, calendar items — EtherInsights does not see them or store them. Read Hornet 365 Total Backup or Xopero ONE for that.
- Not object restore. Tenant Backup restores settings on existing objects. A deleted user, a deleted group, a removed Enterprise application — EtherInsights does not recreate the object itself. Microsoft assigns new identifiers to a recreated object, and any policies, licences and site assignments that pointed at the old object do not automatically repoint. For Entra ID objects: Hornet 365 Total Backup (requires Entra ID P1).
A customer who wants full protection of their Microsoft 365 tenant needs both — a content backup and a configuration backup. They are complementary products, not alternatives.
Restore
The model is simple in principle, with clear limits: compare the live tenant against a pinned snapshot, see the difference, restore settings on existing objects.
- The comparison shows what has changed since the last backup — which policy was edited, which permission was added, which app consent was granted.
- The restore writes the settings back to the existing Microsoft object. Exchange applies the change as a single call; a setting that is rejected is reported.
- Safeguards: the application performing the restore cannot change or remove its own consent during the run. Consent is only restored for enterprise applications that still exist in the tenant.
- Admin consent on restored app registrations has to be given manually after the restore — Microsoft offers no programmatic path to write it.
- Secrets are never captured. Client secrets, private keys, passwords — none of them go into the backup. The restore plan names what needs to be rotated by hand.
Separate from this is the Drift view (configuration drift — when the configuration has drifted away from what was once correct). It pins a snapshot as a reference and compares the live tenant against it over time. Used for review and compliance evidence, not as part of the restore flow.
Storage and licence
The storage is the customer's own. That is an important difference against Hornet 365 Total Backup, which sits in Hornetsecurity's infrastructure. Here the customer chooses:
- Azure Blob Storage — the customer's own Azure subscription.
- Impossible Cloud Object Storage — as an alternative or complement. Requires the customer to hold their own Impossible Cloud subscription and bucket. Ask us about the current status — the live-provider pilot governs when new writes are enabled, and we can answer that when the customer is at that decision.
Immutability (Strict Immutable protection) is available as opt-in. Written snapshots are then protected at the storage layer against change and deletion for a defined period — including by a compromised administrator.
MSP model: an MSP can configure partner-owned Impossible Cloud and assign a separate production bucket to each directly managed customer. The MSP's plan is separate from the customer's own plan, schedule, storage and recovery points.
Verification performed by EtherInsights against stored manifests confirms that the catalogue is consistent — it does not by itself prove that every payload can be read or that every Microsoft setting can be restored. Workload coverage decides what restore can actually do. Run a restore drill before enabling Strict Immutable in production.
Four questions to ask the customer
- Is there already a content backup for Microsoft 365? Hornet 365 Total Backup, Xopero ONE or GitProtect? If not — that is missing first. EtherInsights does not replace it, it complements it.
- How many Conditional Access policies, Named Locations, Entra Role Assignments and app consents have changed in your tenant over the last year? Many, with no documented backup of what they looked like before — then you have been lucky nothing has gone wrong yet. Tenant Backup is the first backup that actually covers that risk.
- Which storage do you already own? Azure Blob is the easiest if the customer already has an Azure subscription. Impossible Cloud is the option when the customer wants their backup outside Microsoft's own infrastructure.
- Will you need to prove a configuration to an auditor? The Drift view does exactly that — a pinned snapshot as evidence of how things looked at a given point in time. If you are in the middle of NIS2 work or an ISO audit, it is a direct win.
Why through a distributor
We do not sell to the end customer. It is not a courtesy, it is the business model: everything goes through you, and we never compete with you at the customer.
What you get beyond the licences: pre-sales technical help, support in standing up a first pilot — EtherInsights is new in our portfolio and has a configuration path with three decisions (storage, workloads, schedules). Support in English and Swedish, and a named contact who knows your business. How the licence works out for the specific customer is something we go through together before you quote — EfficientEther's pricing model is per tenant with MSP options, but we confirm the detail with the vendor per customer.
Getting started
Tell us which M365 content backup the customer already has (or does not have), how complex the configuration is — how many Conditional Access policies, how many Enterprise apps, whether Intune and Purview are in use — and whether the customer wants the backup in their own Azure or in Impossible Cloud. We tell you what we can promise and what it costs.
Further reading
- Microsoft 365 backup — comparison of three content products (Hornet, Xopero, GitProtect)
- Hornetsecurity 365 Total Backup — content and Entra ID objects
- Microsoft 365 backup with Xopero ONE — content without Teams and Entra ID
- Backup — overview of all workloads
Tell us about your M365 tenant
or book a short technical call
About the content on this page. This is a sales-oriented overview, not full product documentation. The details were checked against EfficientEther's own documentation in November 2026 and we review them regularly, but features, workload coverage and storage options change — and a change can pass us by. Always check against the vendor's current documentation before promising anything to a customer: the EtherInsights Tenant Backup documentation. If you are unsure it is quicker to ask us — we take the question to the vendor and come back with an answer you can rely on in a quote. And if something does not work as described — here or in the vendor's documentation — tell us. We report it to the vendor and correct the page.